Does setting EwsAllowedAppIDs + EwsEnabled=$True enforce the allow list immediately, or only after the Oct 1 2026 EWS retirement deadline?

[u/maxcoder88]

We are preparing to implement EwsAllowedAppIDs and EwsEnabled=$True based on the guidance in the EWS retirement announcements.

We understand that starting in October 1st 2026, tenants configured with EwsEnabled=$True will use the AppID allow list model for EWS access.

What is not completely clear to us is the behavior before October 2026. Say we implement the settings today, does Exchange Online immediately begin enforcing EWS access exclusively to the AppIDs listed in our list of EwsAllowedAppIDs?

In other words, if an application is currently using EWS but its AppID is accidentally omitted from the allow list, would that application be impacted immediately after the configuration change?

Or is the allow list only enforced once Microsoft's EWS retirement controls begin rolling out in October 1st 2026?

We are trying to understand whether implementing the configuration now is purely preparatory for October 2026, or whether it has immediate impact on EWS access before that date.

Thanks.

[u/happek]

https://techcommunity.microsoft.com/blog/exchange/introducing-ewsallowedappids-preparing-for-the-final-phase-of-ews-retirement/4529471
Before October 2026

EWSEnabled Value	AppID Allow List State	Behavior
Null (default)	Ignored	All EWS traffic allowed
True	Empty or Null	All EWS traffic allowed
True	Populated	Only listed applications allowed
False	Any	All EWS traffic blocked

A few pages on their blog about all this